I’m using Coda for our internal team’s information management, which works fantastically well for any information that’s accessible to the whole team. We’re using restricted documents for more sensitive information, but there’s the additional challenge of some information needs to only be seen by a very few people, and I don’t want to create a private document for each and every one of them.
I think that I’ve found a solution, and I’m using it in the two ways below and it’s working well. However, I haven’t seen this elsewhere on the message boards so I’m curious if I’m missing something here:
I have one page for the entire company that relies on cross-docs coming from restricted docs. Some of the information from those cross-docs is shown, some is hidden. There are times when I need to expand those hidden cross-docs to fix things though, but no one else should have the ability to do that. So I put in a drop-down menu with the options “Show” and “Hide,” and made a filter so that if “Show” is selected and the variable “CurrentUserEm” is exactly equal to my name, the document shows up.
This is working really well so far! While it does allow the possibility that someone else could see the info I’m seeing while I’m seeing it, that’s a much smaller window of time than it being accessible 24/7. I also have a single button that reverts all of these options to “Hide” when I’m done editing things.
My next goal is to implement something similar, but that shows different information for different people. For example, each manager needs to be able to see information about their team’s employee records, but not all the employee records. So I’m using the formuathisRow.[Reports to].totext() != user().totext(), and that filters all employees on the current user’s team.
This works so well that it feels like I’m missing something, haha. What privacy issues are likely to arise here? Thanks!
Without looking at (a dummy copy) of your doc, it is pretty hard to be conclusive about your question. Coda is not really ready (yet) for this type of security (in my opinion), but there are some ways to work around the limitations.
Your proposed method might work, but you have to make sure that you use the right locking settings (only available in the team plan) and that you make sure your doc can’t be copied (although I am not sure if the latter is an issue when all your sensitive information is coming in through cross docs.
Personally I am not a great fan of cross docs - it is, among other things, not bidirectional.
At some point you might perhaps want your managers to enter some confidential feedback and even though it is possible to set it up in such a way that everyone can only see their own feedback (and you can allow certain users to see that as well), but it does get pretty complicated in a hurry, because you have to define security groups and protect (and lock) all of your tables that contain confidential information.
Access authorization on page (with subpages) level has been discussed in the community in the past and I know the Codans are aware of the fact that quite a few people need/want this. The way a Coda document is organized and loaded requires quite an overhaul to accommodate for this, but…who knows what’s cooking.
Yes, we have a team plan and the doc can’t be copied. The method I’m using is working great for us so far! I’m a little surprised how well it’s working actually, and that’s the main reason for my question.
Also, I agree about cross docs, but unfortunately that’s the only solution available right now. It’s looking like step 2 from my initial post will help reduce the number of cross-docs we need rather dramatically. I would love true access authorization on a page and subpage level though, that would make everything much, much easier to manage from a user’s perspective (though I understand the amount of work involved in implementing it!)
